Control system, relay device and control method

ABSTRACT

A control system  9  according to the present invention is mounted on a moving object. The control system  9  includes: an observing device  92  which transmits observation result data indicating an observation result of surroundings of the moving object; a first control instruction device  91  which transmits first control data indicating the control contents determined based on the observation result data; a movement control device  93  which controls movement of the moving object; and a relay device  95  which relays the first control data transmitted from the first control instruction device  91 , to the movement control device  93 . When a second control instruction device  94  which transmits second control data indicating the control contents determined based on the observation result data is provided to the control system  9 , the relay device  95  transmits the second control data instead of the first control data, to the movement control device  93.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based upon and claims the benefit of priority fromJapanese patent application No. 2014-172433, filed on Aug. 27, 2014, thedisclosure of which is incorporated herein in its entirety by reference.

BACKGROUND

The present invention relates to a control system, a relay device and acontrol method and relates to, for example, a technique of performingcontrol by transmitting and receiving data between a plurality ofdevices.

In recent years, in a social background which demands reduction oftraffic accidents, reliving and easing of traffic jam and improvement ofcomfort of drivers, a drive assist network system for automatic drivingis rapidly spreading. Statistical data shows that a cycle to buy a newcar is a very long cycle such as about 10 years or more. By contrastwith this, since each automaker makes a great effort to reduce trafficaccidents, a new drive assist application program is developed at ashorter cycle than a cycle to buy a new car, and is applied to thelatest car at the time of the development.

In the drive assist network system (in-vehicle system), each domain (ablock in in-vehicle units) or each ECU (Electronic Control Unit)cooperates with each other. In this regard, a development span of anactuator control domain and ECU is generally very long such as 5-yearunits or 10-year units. Meanwhile, a development span of a drive assistdomain and ECU is in a year unit. Hence, to enable addition of a newdrive assist ECU for a purpose of updating a function of the driveassist network system, mounting in advance a mechanism which assumes theaddition of a new drive assist system is necessary yet is verydifficult.

Japanese Unexamined Patent Application Publication No. 2002-314558discloses a technique of solving such a problem. A communication systemdisclosed in Japanese Unexamined Patent Application Publication No.2002-314558 enables addition of an ECU by mounting on each ECU inadvance a mechanism which changes items of individual data whosetransmission destinations are only specific ECUs to items of global datawhose transmission destinations are all ECUs according to a globalchange request.

SUMMARY

However, the technique disclosed in Japanese Unexamined PatentApplication Publication No. 2002-314558 needs to mount the abovemechanism on all ECUs in advance. Hence, there is a problem that thetechnique disclosed in Japanese Unexamined Patent ApplicationPublication No. 2002-314558 involves a very great amount of changes in asystem is required, and cannot be easily performed.

The other tasks and new features will be more apparent from thedescription of the specification and the accompanying drawings.

According to one embodiment, in a control system, when a second controlinstruction device that transmits second control data based onobservation result data from an observing device is provided to thecontrol system, a relay device transmits to a movement control devicethe second control data instead of first control data transmitted from afirst control instruction device based on the observation result datafrom the observing device.

According to the one embodiment, it is possible to easily update afunction.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other aspects, advantages and features will be moreapparent from the following description of certain embodiments taken inconjunction with the accompanying drawings, in which:

FIG. 1 is a view illustrating a configuration of a drive assist networksystem according to a first embodiment;

FIG. 2 is a view illustrating an example of a format of data transmittedthrough a central gateway according to the first embodiment;

FIG. 3 is a view illustrating a configuration of a filtering controlleraccording to the first embodiment;

FIG. 4 is a view illustrating data of a ROM of the filtering controlleraccording to the first embodiment;

FIG. 5 is a flowchart illustrating processing of the filteringcontroller according to the first embodiment;

FIG. 6 is a flowchart illustrating processing of the drive assistnetwork according to the first embodiment;

FIG. 7 is a view for explaining an example of a drive assist function ofa drive assist ECU according to the first embodiment;

FIG. 8 is a view for explaining an example of the drive assist functionof an add-on ECU according to the first embodiment;

FIG. 9 is a view illustrating another example of a format of datatransmitted through the central gateway according to the firstembodiment;

FIG. 10 is a flowchart illustrating processing of a drive assist networksystem according to a second embodiment;

FIG. 11 is a view illustrating a configuration of a filtering controlleraccording to a third embodiment;

FIG. 12 is a flowchart illustrating processing of the filteringcontroller according to the third embodiment;

FIG. 13 is a flowchart (1/2) illustrating processing of a drive assistnetwork system according to the third embodiment;

FIG. 14 is a flowchart (2/2) illustrating processing of the drive assistnetwork system according to the third embodiment;

FIG. 15 is a view illustrating a configuration of a drive assist networksystem according to a fourth embodiment;

FIG. 16 is a view illustrating a configuration of an intelligent robotaccording to a fifth embodiment;

FIG. 17 is a view illustrating a configuration of a rise warning systemaccording to a sixth embodiment;

FIG. 18 is a view illustrating a configuration of a filtering controlleraccording to a seventh embodiment;

FIG. 19 is a flowchart illustrating processing of a drive assist networksystem according to a seventh embodiment;

FIG. 20 is a view illustrating a configuration of a drive assist networksystem according to an eighth embodiment;

FIG. 21 is a flowchart (1/2) illustrating processing of the drive assistnetwork system according to the eighth embodiment;

FIG. 22 is a flowchart (2/2) illustrating processing of the drive assistnetwork system according to the eighth embodiment;

FIG. 23 is a view illustrating a configuration of a drive assist networksystem according to a ninth embodiment; and

FIG. 24 is a view illustrating a configuration of a control systemaccording to a tenth embodiment.

DETAILED DESCRIPTION

Preferred embodiments of the present invention will be described belowwith reference to the accompanying drawings. Specific numerical valuesdescribed in the following embodiments are exemplary values for ease ofunderstanding of the invention, and are not limited to those unlessspecified in particular. Further, obvious matters and the like for oneof ordinary skill in the art will be optionally omitted and simplifiedin the following disclosure and drawings for clarification ofexplanation.

First Embodiment Configuration of Drive Assist Network System 1

The first embodiment will be described below. A configuration of thedrive assist network system 1 according to the first embodiment will bedescribed with reference to FIG. 1. As illustrated in FIG. 1, the driveassist network system. 1 includes a central gateway 2, a drive assistECU 10, a sensor domain 20, a power train domain 30, a chassis domain 40and an add-on ECU 60. Further, the central gateway 2 includes afiltering controller 50. In the first embodiment, an example where thedrive assist network system 1 is mounted on a car will be described.

Each of the ECUs and domains 10, 20, 30, 40 and 60 adopt arbitrarystandards among various standards (communication protocols) such as aCAN (Controller Area Network), the Ethernet (registered trademark) andFlexRay for buses in ECU units or domain units. Hence, ECUs 201 and 202in the sensor domain 20, ECUs 401 and 402 in the chassis domain 40, anECU 301 in the power train domain 30, the drive assist ECU 10 and theadd-on ECU 60 may be connected with the central gateway 2 according todifferent protocols. The central gateway 2 enables data transfer betweenthe ECUs and domains 10, 20, 30, 40 and 60 by connecting the buses ofthe ECUs and domains 10, 20, 30, 40 and 60 with each other andconverting the protocol when necessary.

The drive assist ECU 10 determines control contents of an own car basedon an observation result of surroundings of the own car, and controlsthe own car according to the determined control contents. Morespecifically, the drive assist ECU 10 determines the control contents ofthe own car based on the observation result of the sensor domain 20, andinstructs the power train domain 30 and the chassis domain 40 to controlthe own car according to the determined control contents. Thus, when,for example, recognizing an obstacle ahead of the own car, the driveassist ECU 10 controls the own car to hedge this obstacle and supportsthe driver's driving. In addition, the drive assist ECU 10 is notlimited to control of this pre-crash safety system, and may controlvarious types of automatic driving.

The sensor domain 20 includes the front camera ECU 201 and the radar ECU202. The front camera ECU 201 is connected with a front camera 211. Theradar ECU 202 is connected with a radar 221.

The front camera ECU 201 detects an obstacle in the surroundings of theown car based on an imaging result of the front camera 211, and notifiesthe drive assist ECU 10 of this detection result. More specifically, thefront camera ECU 201 detects the obstacle in the surroundings of the owncar based on image data received from the front camera 211, andgenerates object data indicating the detected obstacle. That is, thefront camera ECU 201 performs primary processing on the image data (RAWdata), and easily processes object data indicating the obstacle with asmaller amount of data. For example, this object data may be data whichindicates a position, a size and a type (a car, a pedestrian or abicycle) of a detected obstacle as data indicated as a list per detectedobstacle. The front camera ECU 201 transmits the generated object dataas sensor data to the drive assist ECU 10 through the central gateway 2.

The front camera 211 captures an image of the surroundings of the owncar. The front camera 211 generates image data indicating the image ofthe surroundings of the own car by this imaging operation, and transmitsthe image data to the front camera ECU 201. The front camera 211 istypically installed in the own car to face toward the front of the owncar.

The radar ECU 202 calculates calculated distance data based onmeasurement distance data of a distance to the obstacle in thesurroundings of the own car measured by the radar 221, and notifies thedrive assist ECU 10 of this calculated distance data. More specifically,the radar ECU 202 calculates a distance from the own car to the obstaclebased on the measurement distance data received from the radar 221, andgenerates calculated distance data indicating the calculated distance tothe obstacle. That is, the radar ECU 202 performs primary processing onmeasurement distance data (RAW data), and easily generates calculateddistance data indicating a distance to the obstacle with a smalleramount of data.

For example, this calculated distance data may be point cloud data (dataindicating an obstacle as a three-dimensional point group) indicating adistance to an obstacle at a larger granularity than that of measurementdistance data. The radar ECU 202 indicates, for example, a smallobstacle such as a pedestrian as a point group of a small granularity inpoint cloud data, and indicates an obstacle such as a car larger thanthe small obstacle as a point group of a large granularity. Hence, thedrive assist ECU 10 may recognize an obstacle type according to agranularity of a point group indicating an obstacle in point cloud databy, for example, recognizing as a pedestrian an object indicated by apoint group of a small granularity and recognizing as a car an objectindicated by a point group of a large granularity. Further, the pointcloud data makes it possible to specify a surface shape of an obstacleas a distance to each point of the obstacle. Hence, the drive assist ECU10 may identify the obstacle type based on the surface shape of theobstacle specified based on the point cloud data.

Further, for example, this calculated distance data may be inter-cardistance data indicating only a distance to a car ahead of the own car.The inter-car distance data may be data obtained by clipping frommeasurement distance data a range in which a car ahead of the own carexists, or may be data indicating only a distance to a car (obstacle)ahead of the own car indicated by object data by causing the radar ECU202 to obtain the object data from the front camera ECU 201. The radarECU 202 transmits the generated calculated distance data as sensor datato the drive assist ECU 10 through the central gateway 2.

The radar 221 measures a distance to an obstacle in the surroundings ofthe own car by an electromagnetic wave such as a light wave (includinginfrared ray) and a radio wave (including a millimeter wave). The radar221 generates measurement distance data indicating a measured distanceto an obstacle, and transmits the distance measurement data to the radarECU 202. The radar 221 is typically installed in the own car to faceforward.

The drive assist ECU 10 receives these items of sensor data as anobservation result of the sensor domain 20, and determines controlcontents of the own car. Further, the drive assist ECU 10 generatescontrol data indicating the determined control contents of the own car,and transmits the control data to the power train domain 30 and thechassis domain 40 through the central gateway 2.

The power train domain 30 includes an engine control ECU 301. The enginecontrol ECU 301 is connected with an engine 311. The power train domain30 transmits control data received from the drive assist ECU 10, to theengine control ECU 301.

The engine control ECU 301 controls the engine 311 according to thecontrol data from the power train domain 30. More specifically, theengine control ECU 301 controls a fuel injection amount, ignition timingcontrol and a variable valve timing of the engine 311 based on, forexample, the control data received from the drive assist ECU 10.

The chassis domain 40 includes the steering control ECU 401 and theaccelerator control ECU 402. The steering control ECU 401 is connectedwith a steering 411. The accelerator control ECU 402 is connected withan accelerator 421 and a brake 422. The chassis domain 40 transmits thecontrol data received from the drive assist ECU 10, to the steeringcontrol ECU 401 and the accelerator control ECU 402.

The steering control ECU 401 controls the steering 411 according to thecontrol data from the chassis domain 40. More specifically, the steeringcontrol ECU 401 controls a turning angle of the steering 411 based on,for example, the control data received from the drive assist ECU 10.

The accelerator control ECU 402 controls the accelerator 421 and thebrake 422 according to the control data from the chassis domain 40. Morespecifically, the accelerator control ECU 402 controls a brake hydraulicpressure of the brake 422 based on, for example, the control datareceived from the drive assist ECU 10. Further, the accelerator controlECU 402 controls a throttle valve of the accelerator 421 based on, forexample, the control data received from the drive assist ECU 10. Thatis, an example where the accelerator 421 is an electronic throttle willbe described in the first embodiment.

The central gateway 2 includes the filtering controller 50. Thefiltering controller 50 relays sensor data transmitted from the sensordomain 20 to the drive assist ECU 10. Further, the filtering controller50 plays a role of relaying the control data transmitted from the driveassist ECU 10, to the power train domain 30 and the chassis domain 40.

The add-on ECU 50 corresponds to a drive assist ECU configured by addinga function to (expanding a function of) the drive assist ECU 10. Hence,similar to the drive assist ECU 10, the add-on ECU 60 can also controlthe own car by generating control data based on sensor data transmittedfrom the sensor domain 20, and transmitting the generated control datato the power train domain 30 and the chassis domain 40.

In this regard, the add-on ECU 60 is additionally mounted on the driveassist network system 1. The drive assist network system 1 controls theown car by using the add-on ECU 60 instead of the drive assist ECU 10when the add-on ECU 60 is mounted on the drive assist network system 1.In other words, when the add-on ECU 60 is mounted on the drive assistnetwork system 1, the drive assist ECU 10 is disabled and the add-on ECU60 is enabled. By this means, by additionally mounting the add-on ECU 60on the drive assist network system 1, it is possible to update a driveassist function of the drive assist network system 1.

Further, the filtering controller 50 controls data transfer, so that theadd-on ECU 60 instead of the drive assist ECU 10 can control the owncar. More specifically, only control data transmitted from the add-onECU 60 among the drive assist ECU 10 and the add-on ECU 60 istransmitted to the power train domain 30 and the chassis domain 40. Thatis, by discarding the control data transmitted from the drive assist ECU10, the filtering controller 50 transmits the control data transmittedfrom the add-on ECU 60 instead of this control data to the power traindomain 30 and the chassis domain 40. Thus, only the add-on ECU 60 cancontrol the own car according to the control data. The power traindomain 30 and the chassis domain 40 will be also collectively referredto as the “control domains 30 and 40” below.

(Frame Format of Data Frame)

Next, a format of data (e.g. sensor data and control data) transmittedin the central gateway 2 according to the first embodiment will bedescribed with reference to FIG. 2. In this regard, an example wheredata relayed by the filtering controller 50 in the central gateway 2 isa data frame which complies with the CAN protocol will be described inthe first embodiment. This data frame is a frame format illustrated inFIG. 2. In addition, the frame format of this CAN protocol is a generalformat, and therefore fields of the data frame related to processing ofthe present invention will be described and other fields will not bedescribed.

The data frame includes an ID field, a control field, a data field and aCRC field as illustrated in FIG. 2.

The ID field is a portion which includes data indicating a frame ID inthe data frame. The frame ID is information uniquely determined per datatype or per ECU. According to the CAN protocol, each ECU transmits thedata frame to all of the other ECUs by way of broadcasting. When theframe ID included in the received data frame is a processing targetframe ID, each ECU executes processing based on this data frame.

For example, each of the ECUs 201 and 202 of the sensor domain 20includes the frame ID of sensor data in the ID field, and transmits dataframe including sensor data in the data field. In addition, strictlyspeaking, different frame IDs are set to the object data transmittedfrom the front camera ECU 201 and calculated distance data transmittedfrom the radar ECU 202. The drive assist ECU 10 and the add-on ECU 60recognize in advance the frame ID of the sensor data as the frame ID ofthe processing target data frame. Hence, when the frame ID of thereceived data frame is the frame ID of the sensor data, the drive assistECU 10 and the add-on ECU 60 execute processing of determining controlcontents of the own car based on the sensor data included in this dataframe. Meanwhile, the control domains 30 and 40 do not recognize theframe ID of the sensor data as the frame ID of the processing targetdata frame. Hence, when the frame ID of the received data frame is theframe ID of the sensor data, the control domains 30 and 40 ignore thisdata frame, and do not execute processing based on the sensor data.

Further, for example, the drive assist ECU 10 and the add-on ECU 60include the frame ID of the control data in the ID field, and transmitsthe data frame including the control data in the data field. Inaddition, strictly speaking, different frame IDs are set to the controldata transmitted by the drive assist ECU 10 and the control datatransmitted by the add-on ECU 60. That is, when items of data are thesame type and transmission source ECUs are different, different frameIDs may be allocated to make it possible to distinguish that the itemsof data have been transmitted from different ECUs. Hereinafter, a casewhere a frame ID is different per ECU which transmits data, per datatype and per combination thereof will be described in the firstembodiment. The ECUs 301, 401 and 402 of the control domains 30 and 40recognize the frame ID of the control data from the drive assist ECU 10as the frame ID of the processing target data frame. Hence, when theframe ID of the received data frame is the frame ID of the control datafrom the drive assist ECU 10, the ECUs 301, 401 and 402 of the controldomains 30 and 40 execute processing of controlling the own car based onthe control data included in this data frame. Meanwhile, when the frameID of the received data frame is the frame ID of the control data, theECUs 201 and 202 of the sensor domain 20 do not execute processing basedon the control data included in this data frame.

As described above, each ECU can identify processing target data, andexecute processing based on this data. In this regard, the ECUs 301, 401and 402 of the control domains 30 and 40 recognize the frame ID of thecontrol data from the drive assist ECU 10 as the frame ID of theprocessing target data frame, yet do not recognize the frame ID of thecontrol data from the add-on ECU 60 to be mounted later as the frame IDof the processing target data frame.

However, as described above, it is very difficult to mount the mechanismwhich assumes that the add-on ECU 60 is added later, on the ECUs 301,401 and 402 of the control domains 30 and 40. By contrast with this, inthe first embodiment, the mechanism in the filtering controller 50described later disables the drive assist ECU 10 and enables the add-onECU 60 by controlling the data frame.

The control filed is a portion including data including a length of asubsequent data field.

A CRC field is a portion of the data frame including a CRC (CyclicRedundancy Check) value for performing error detection. An ECU whichtransmits a data frame calculates and sets the CRC value based on dataof a plurality of fields including ID fields and data fields. Thus, theECU which has received the data frame can detect a data error bycalculating the CRC value from this data frame and comparing the CRCvalue and a CRC value included in the data frame.

(Configuration of Filtering Controller 50)

Next, a configuration of the filtering controller 50 according to thefirst embodiment will be described with reference to FIG. 3. Asillustrated in FIG. 3, the filtering controller 50 includes a framecapture 501, a frame ID reconfiguring unit 502, a CRC encoder 503, a CPU(Central Processing Unit) 504 and a ROM (Read Only Memory) 510.

The frame capture 501 obtains a data frame including a desired frame IDamong data frames transmitted in the central gateway 2, and passes thedata frame to the frame ID reconfiguring unit 502 or discards the dataframe. The frame capture 501 transmits the other data frames to atransmission destination without transmitting the other data framesthrough the frame ID reconfiguring unit 502 and the CRC encoder 503.

The frame ID reconfiguring unit 502 changes the frame ID of the dataframe passed from the frame capture 501.

The CRC encoder 503 calculates a CRC value based on the data frame whoseframe ID has been changed by the frame ID reconfiguring unit 502. TheCRC encoder 503 changes the CRC value included in the data frame, to thecalculated CRC value. Further, the CRC encoder 503 transmits the dataframe whose CRC value has been changed, to a transmission destination.Thus, the CRC value corresponding to the data frame of the changed frameID is set to the data frame. Thus, it is possible to prevent errordetection of a data error due to the change in the frame ID.

The CPU 504 integrally controls each unit 501 to 503 in the filteringcontroller 50. When, for example, the add-on ECU 60 is mounted on thedrive assist network system 1, the CPU 504 notifies the frame capture501 of the frame ID of the data frame to be obtained from the dataframes transmitted in the central gateway 2. Further, when the add-onECU 60 is mounted on the drive assist network system 1, the CPU 504notifies the frame ID reconfiguring unit 502 of the frame IDreconfigured to the data frame.

In the ROM 510, frame ID data indicating a frame ID notified by the CPU504 is stored in advance. This frame ID data may be stored in the ROM510 before an operation of the drive assist network system 1 starts ormay be written in the ROM 510 when the add-on ECU 60 is additionallymounted. Further, when the add-on ECU 60 is additionally mounted or whenthe drive assist network system 1 is activated (e.g. an ignition of theown car is powered on), the CPU 504 may read this frame ID data from theadd-on ECU 60 to store in the ROM 510. In this case, preferably, thisframe ID data is encrypted and transmitted from the add-on ECU 60 to theCPU 504 of the filtering controller 50. By so doing, it is possible toimprove security.

Next, frame ID data stored in the ROM 510 will be described withreference to FIG. 4. As illustrated in FIG. 4, items of frame ID data511 to 513 are stored in the ROM 510.

The frame ID data 511 is data indicating a frame ID of a data framewhich the filtering controller obtains to reconfigure the frame ID. Asillustrated in FIG. 4, the frame ID data 511 indicates a frame ID ofcontrol data transmitted from the add-on ECU 60. When the add-on ECU 60is mounted on the drive assist network system 1, the CPU 504 obtains theframe ID data 511 from the ROM 510, and transmits the frame ID data 511to the frame capture 501. Thus, the frame capture 501 obtains the frameID indicated by the frame ID data 511 transmitted from the CPU 504, andrecognizes the frame ID as a frame ID of a data frame to pass to theframe ID reconfiguring unit 502.

The frame ID data 512 is data indicating a frame ID of a data framewhich the filtering controller 50 obtains to discard. As illustrated inFIG. 4, the frame ID data 512 indicates a frame ID of control datatransmitted from the drive assist ECU 10. When the add-on ECU 60 ismounted on the drive assist network system 1, the CPU 504 obtains theframe ID data 512 from the ROM 510, and transmits the frame ID data 512to the frame capture 501. Thus, the frame capture 501 obtains the frameID indicated by the frame ID data 512 transmitted from the CPU 504, andrecognizes the frame ID as a frame ID of a data frame to be discarded.

The frame ID data 513 is data indicating a frame ID newly set to a dataframe when the filtering controller 50 reconfigures the frame ID. Asillustrated in FIG. 4, the frame ID data 513 indicates a frame ID ofcontrol data transmitted from the drive assist ECU 10. When the add-onECU 60 is mounted on the drive assist network system 1, the CPU 504obtains the frame ID data 513 from the ROM 510, and transmits the frameID data 513 to the frame ID reconfiguring unit 502. Thus, the frame IDreconfiguring unit 502 recognizes the frame ID indicated by the frame IDdata 513 transmitted from the CPU 504, as a frame ID newly set to thedata frame obtained by the frame capture 501.

In addition, the other data frames are outputted to a transmissiondestination as is from the filtering controller 50. In this regard,upon, for example, activation of the drive assist network system 1, theCPU 504 obtains the items of the frame ID data 511 to 513 from the ROM510, and transmits the items of the frame ID data 511 to 513 to theframe capture 501 and the frame ID reconfiguring unit 502.

In this regard, as described above, the frame ID takes different valueper data type. However, for simplification of description, a frame ID ofcontrol data transmitted from the drive assist ECU 10 will be alsoreferred to as “a frame ID of the drive assist ECU 10”, and a frame IDof control data transmitted from the add-on ECU 60 will be also referredto as “a frame ID of the add-on ECU 60” below.

(Processing of Filtering Controller 50)

Next, processing of the filtering controller 50 according to the firstembodiment will be described with reference to FIG. 5.

The frame capture 501 obtains a data frame including a frame ID of aframe ID reconfiguration target data frame among data frames flowing inthe central gateway 2 (S1). That is, the frame capture 501 obtains thedata frame indicating the frame ID indicated by the frame ID data 511transmitted from the CPU 504. In other words, the frame capture 501obtains a data frame indicating the frame ID of the add-on ECU 60.Further, the frame capture 501 transmits this data frame to the frame IDreconfiguring unit 502.

In addition, the frame capture 501 obtains a data frame including aframe ID of a discard target data frame, too, among the data framesflowing in the central gateway 2. That is, the frame capture 501 obtainsa data frame indicating a frame ID indicated by the frame ID data 512transmitted from the CPU 504 (S1). In other words, the frame capture 501obtains the data frame indicating the frame ID of the drive assist ECU10. Further, the frame capture 501 discards this data frame.

The frame ID reconfiguring unit 502 reconfigures the frame ID of thedata frame transmitted from the frame capture 501 (S2). That is, theframe ID reconfiguring unit 502 sets to the data frame the frame IDindicated by the frame ID data 513 transmitted from the CPU 504. Inother words, the frame ID reconfiguring unit 502 changes the frame IDincluded in the data frame from the frame ID of the add-on ECU 60 to theframe ID of the drive assist ECU 10. The CRC encoder 503 calculates aCRC value of the data frame to which the frame ID has been reconfiguredby the frame ID reconfiguring unit 502, and sets the CRC value to thisdata frame (S3).

Consequently, when the add-on ECU 60 is mounted on the drive assistnetwork system 1, it is possible to transmit control data transmittedfrom the add-on ECU 60 instead of control data transmitted from thedrive assist ECU 10, to the control domains 30 and 40. Further, theframe ID of the data frame of this control data is changed to the frameID from the drive assist ECU 10, so that it is possible to cause thecontrol domains 30 and 40 to tentatively recognize the control data fromthe add-on ECU 60 as processing target control data from the driveassist ECU 10. That is, according to this processing, it is possible todisable the drive assist ECU 10 and enable the add-on ECU 60 byadditionally mounting the add-on ECU 60 on the drive assist networksystem 1.

(Processing of Drive Assist Network System 1)

Next, processing of the drive assist network system 1 according to thefirst embodiment will be described with reference to FIG. 6.

The filtering controller 50 determines whether or not the add-on ECU 60is connected to the central gateway 2 (S11). In this regard, whether ornot the add-on ECU 60 is physically connected to the central gateway 2may be simply determined. However, the determination is not limited tothis. In addition, the filtering controller 50 may authenticateauthentication information by receiving the authentication informationfrom the add ECU 60, and determine that the add-on ECU 60 has beenconnected with the central gateway 2 when validity of the add-on ECU 60can be confirmed.

For example, an expectation value of the authentication information ofthe add-on ECU 60 is stored in advance in the ROM 510 included in thefiltering controller 50. This expectation value may be stored in the ROM510 before an operation of the drive assist network system 1 starts ormay be written in the ROM 510 when the add-on ECU 60 is additionallymounted. This authentication information is, for example, informationindicating an identifier (ID) uniquely allocated to each ECU. Thefiltering controller 50 compares the authentication informationtransmitted from the add-on ECU 60 and the expectation value stored inthe ROM 510. The filtering controller 50 determines that the add-on ECU60 is valid when the authentication information and the expectationvalue match, and determines that the add-on ECU 60 is not valid when theauthentication information and the expectation value do not match.

When determining that the add-on ECU 60 is not connected to the centralgateway 2 (S11: No), the filtering controller 50 transmits the sensordata transmitted from the sensor domain 20, to the drive assist ECU 10(S12). The drive assist ECU 10 calculates control data based on thesensor data transmitted from the sensor domain 20 through the filteringcontroller 50 (S13). The drive assist ECU 10 transmits the generatedcontrol data to the control domains 30 and 40 (S14). This control datais relayed at the filtering controller 50, and the filtering controller50 transmits the control data as is to the control domains 30 and 40.

When determining that the add-on ECU 60 is connected to the filteringcontroller 50 (S11: Yes), the filtering controller 50 transmits thesensor data transmitted from the sensor domain 20 to both of the driveassist ECU 10 and the add-on ECU 60 (S15). The add-on ECU 60 calculatescontrol data based on the sensor data transmitted from the sensor domain20 through the filtering controller 50 (S16). Similar to step S13, thedrive assist ECU 10 also calculates control data based on the sensordata transmitted from the sensor domain 20 through the filteringcontroller 50 (S17).

The drive assist ECU 10 and the add-on ECU 60 transmit the calculatedcontrol data to the filtering controller 50 (S18). The filteringcontroller 50 discards the control data transmitted from the driveassist ECU 10, and transmits the control data from the add-on ECU 60 asthe control data from the drive assist ECU 10 to the control domains 30and 40 (S19).

According to the above-described processing, by connecting the add-onECU 60, it is possible to control the own car by a drive assist functionof the add-on ECU 60 whose function has been expanded instead of thedrive assist function of the drive assist ECU 10.

(Example of Drive Assist Function)

Next, an example of the drive assist function of the drive assist ECU 10and the drive assist function of the add-on ECU 60 will be describedwith reference to FIGS. 7 and 8. An example where a collision predictionemergency automatic brake system which operates when the own car drivesat a certain speed or less is mounted as the drive assist function onthe drive assist ECU 10, and a function which automatically performs asteering operation is mounted as the drive assist function on the add-onECU 60 in addition to the collision prediction emergency automatic brakesystem which operates when the own car drives at a certain speed or lesswill be described.

First, the example of the drive assist function of the drive assist ECU10 will be described with reference to FIG. 7. When the own carcontinues driving, the drive assist ECU 10 determines based on sensordata whether or not the own car is likely to collide with an obstacle (acar driving ahead of the own car in the example in FIG. 7) ahead of theown car. More specifically, the drive assist ECU 10 determines thatcollision is likely to occur when a distance between the own car and theobstacle is a threshold or less, and determines that collision is notlikely occur when the distance between the own car and the obstacle islarger than the threshold. This threshold is a value arbitrarilydetermined in advance. The drive assist ECU 10 keeps controlling the owncar by a driver's operation in a manual operation mode when determiningthat collision is not likely to occur. Meanwhile, the drive assist ECU10 switches to an automatic operation mode when determining thatcollision is likely to occur. That is, a control right of the own car istransferred from the driver to the drive assist network system 1.Further, the drive assist ECU 10 determines an emergency brake ascontrol contents of the own car. That is, the drive assist ECU 10generates control data indicating content contents for putting on anemergency brake, and transmits the control data to the control domains30 and 40.

Next, the example of the drive assist function of the add-on ECU 60 willbe described with reference to FIG. 8. When the own car continuesdriving, the add-on ECU 60 also determines based on sensor data whetheror not the own car is likely to collide with an obstacle (a car drivingahead of the own car and a car crossing ahead of the own car in theexample in FIG. 8) ahead of the own car. The determination has beendescribed above with reference to FIG. 7 and therefore will not bedescribed in detail. That is, the add-on ECU 60 has a function expandedfrom that of the drive assist ECU 10 and has a function of switching tothe automatic operation mode according to whether or not collision islikely to occur similar to the drive assist ECU 10, so that it ispossible to hedge collision with an obstacle by putting on the emergencybrake likewise in the example illustrated in FIG. 7.

In this regard, the add-on ECU 60 further has an additional function ofdetermining whether or not a steering operation needs to be performed.According to this function, when, for example, there is an obstacle at aright side of a traveling direction of the own car among obstacles whosedistances to the own car are the threshold or less, the add-on ECU 60determines that the steering operation needs to be performed anddetermines detouring to the left side as control contents of the owncar. That is, the add-on ECU 60 can determine detouring of the own carto an opposite side to a side of the obstacle based on the travelingdirection of the own car. Hence, the add-on ECU 60 generates controldata indicating control contents for putting on an emergency brake whileturning the steering to the left, and transmits the control data to thecontrol domains 30 and 40.

In addition, an example where (1) a distance between an own car and anobstacle and (2) a position of the obstacle based on a travelingdirection of the own car are used as parameters for determining controlcontents of the own car has been described, yet parameters are notlimited to these. In addition, (3) the number of obstacles, (4) a speedof the own car and (5) a moving direction of an obstacle may be used asparameters for determining control contents of the own car. That is,arbitrary one or more parameters (1) to (5) may be used.

In case where, for example, (3) is used, when there are a predeterminednumber of obstacles or more whose distances to the own car are thethreshold or less, an operation mode is switched to the automaticoperation mode to put on the emergency brake, and, when the number ofobstacles whose distances to the own car are the threshold or less isless than a predetermined number, the manual operation mode may be kept.

Further, in case where, for example, (4) is used, when a time which theown car takes to reach an obstacle is calculated based on a distancebetween the own car and the obstacle and the speed of the own car, andthe time is a threshold or less, the operation mode is switched to theautomatic operation mode to put on the emergency brake and, when thetime is larger than the threshold, the manual operation mode may bekept.

Furthermore, in case where, for example, (5) is used, when an obstacleapproaches the own car, an operation mode is switched to the automaticoperation mode to put on the emergency brake and, when the obstaclemoves away from the own car, the manual operation mode may be kept.Still further, in this case, the time which the own car takes to reachthe obstacle is calculated by using the speed of the obstacle, too,based on the distance between the own car and the obstacle and thespeeds of the own car and the obstacle, and the time is the threshold orless, the operation mode is switched to the automatic operation mode toput on the emergency brake and, when the time is larger than thethreshold, the manual operation mode may be kept.

Further, the degree to hedge an obstacle (e.g. the degree of braking ora turning degree of a steering) may be changed stepwise. For example, atable in which distances between the own car and obstacles and thedegree of braking are associated is stored in advance in ROMs includedin the drive assist ECU 10 and the add-on ECU 60. This table isinformation indicating a stronger degree of braking as the distancebetween the own car and an obstacle shortens. Further, the drive assistECU 10 and the add-on ECU 60 determine the degree of braking accordingto a distance between the own car and the obstacle based on this table.

(Modified Example of First Embodiment)

A case where a CAN protocol has been adopted as a communication protocolused to transmit data in a central gateway 2 has been described above.However, the communication protocol is not limited to this. For example,a TCP/IP protocol may be adopted as a communication protocol whichrelays data through a filtering controller 50 in the central gateway 2.In this case, a date frame has a frame format illustrated in FIG. 9. Inaddition, a frame format of this TCP/IP protocol is a general frameformat, and therefore fields related to processing of the presentembodiment will be described and other fields will not be described.

In this case, as illustrated in FIG. 9, a data frame includes adestination address field, a transmission source address field, a datafield and a FCS (Frame Check Sequence) field.

In this case, in a ROM 510 of the filtering controller 50, address dataindicating a transmission source address of a data frame to obtain isstored instead of a frame ID data of control data included in a dataframe to obtain. That is, in the ROM 510, address data of a drive assistECU 10 is stored in advance as a transmission address of a data frame toobtain to discard, and address data of an add-on ECU 60 is stored inadvance as a transmission source address of a data frame to obtain toreconfigure a frame ID. Further, a CPU 504 obtains these items ofaddress data from the ROM 510, and transmits these items of address datato a frame capture 501. Thus, the frame capture 501 discards the dataframe including the control data from the drive assist ECU 10, andtransmits a data frame including the control data from the add-on ECU60, to a frame ID reconfiguring unit 502.

Further, in the ROM 510, address data indicating a transmission sourceaddress reconfigured to a data frame is stored instead of frame ID dataindicating a frame ID reconfigured to a data frame. Further, the CPU 504transmits this address data to the frame ID reconfiguring unit 502.Thus, the frame ID reconfiguring unit 502 tentatively changes atransmission source address of a data frame including the control datatransmitted from the add-on ECU 60, from the address of the add-on ECU60 to an address of the drive assist ECU 10. Hence, in this case, theframe ID reconfiguring unit 502 operates as an address reconfiguringunit.

In addition, a destination address of a data frame of sensor data fromthe sensor domain 20 indicates the drive assist ECU 10, but the add-onECU 60 can obtain the data frame by reading the destination address as adata frame to the add-on ECU 60. Further, a destination address of adata frame of the sensor data from this sensor domain 20 to betransmitted to the add-on ECU 60 may be reconfigured by the filteringcontroller 50 to indicate the add-on ECU 60. Reconfiguring thisdestination address as an address of the add-on ECU 60 only needs to beperformed in the same way as the method described later in the secondembodiment.

Further, a CRC encoder 503 calculates a CRC value based on a data framewhose transmission source address has been changed. The CRC encoder 503changes the CRC value set to the FCS field of the data frame, to a newlycalculated CRC value. In addition, the CRC value is calculated based ondata of a plurality of fields including a destination address field, atransmission source address field and a data field.

As described above, according to the first embodiment, it is possible toprovide an advanced drive assist function to be mounted on the add-onECU 60 only by mounting the add-on ECU 60 on a drive assist networksystem 1. Further, the filtering controller 50 mounted inside thecentral gateway 2 performs control as if the existing drive assist ECU10 issued an instruction, so that it is possible to suppress changes inother domains 20, 30, 40, other ECUs 201, 301, 401, 402 and power trainand chassis control target devices (an engine 311, a steering 411, anaccelerator 421 and a brake 422) as much as possible, and perform anoperation without significantly influencing an existing system.

Second Embodiment

Next, the second embodiment will be described. The same contents asthose in the first embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals.

In the first embodiment, a method of transmitting sensor data to both ofa drive assist ECU 10 and an add-on ECU 60 and transmitting only data ofthe add-on ECU 60 to control domains 30 and 40 has been described as amethod of disabling the drive assist ECU 10 and enabling the add-on ECU60. However, the present invention is not limited to this.

In the second embodiment, a method of transmitting sensor data only tothe add-on ECU 60 will be described as another method of disabling thedrive assist ECU 10 and the enabling the add-on ECU 60.

(Configuration of Drive Assist Network System 1 According to SecondEmbodiment)

A configuration of the drive assist network system 1 according to thesecond embodiment is the same as the configuration of the drive assistnetwork system 1 according to the first embodiment described withreference to FIG. 1, and therefore will not be described. In addition,the second embodiment will be described assuming that transmission in acentral gateway 2 is also performed according to a CAN protocol.

(Configuration of Filtering Controller 50 According to SecondEmbodiment)

The configuration of the filtering controller 50 according to the secondembodiment is the same as the configuration of the filtering controller50 according to the first embodiment described with reference to FIG. 3.However, the filtering controller 50 according to the second embodimentdiffers from the filtering controller 50 according to the firstembodiment in the following operation.

A frame capture 501 acquires a data frame including sensor datatransmitted from a sensor domain 20. Further, the frame capture 501transmits the acquired data frame to the add-on EU 60 instead of thedrive assist ECU 10 without transmitting the data frame to the driveassist ECU 10. Hence, in the second embodiment, sensor data is outputtedfrom the filtering controller 50 individually (to the drive assist ECU10 and the add-on ECU 60) as illustrated in FIG. 1. Consequently, onlythe add-on ECU 60 calculates control data based on the sensor data.Hence, only the add-on ECU 60 controls an own car.

Hence, a CPU 504 notifies the frame capture 501 of a frame ID of thesensor data from the sensor domain 20, too, as a frame ID of a dataframe to obtain to prevent the data frame from being transmitted to thedrive assist ECU 10. That is, in a ROM 510 included in the filteringcontroller 50, frame ID data indicating the sensor data from the sensordomain 20 is stored in advance as a frame ID of a data frame to obtainto transmit to the add-on ECU 60. In this regard, frame IDs of sensordata includes two types of a frame ID of object data from a front cameraECU 201 and a frame ID of calculated distance data from a radar ECU 202.Thus, the frame capture 501 transmits the sensor data from the sensordomain 20 to the add-on ECU 60 based on the frame ID data obtained bythe CPU 504 from the ROM 510 and transmitted without transmitting thesensor data to the drive assist ECU 10.

Consequently, control data based on the sensor data is not transmittedfrom the drive assist ECU 10, so that the frame capture 501 does notneed to perform processing of discarding the control data obtained fromthe drive assist ECU 10. In a modified example of the second embodiment,the CPU 504 may not notify the frame capture 501 of a frame ID of thedrive assist ECU 10 as a frame ID of a data frame to discard.

Consequently, when the add-on ECU 60 is mounted on the drive assistnetwork system 1, it is possible to transmit the sensor data transmittedfrom the sensor domain 20 to the add-on ECU 60 instead of the driveassist ECU 10. Consequently, it is possible to disable the drive assistECU 10, enable the add-on ECU 60 and transmit control data transmittedonly form the add-on ECU 60, to the control domains 30 and 40.

(Processing of Drive Assist Network System 1 According to SecondEmbodiment)

Next, processing of the drive assist network system 1 according to thesecond embodiment will be described with reference to FIG. 10.

The processing illustrated in FIG. 10 differs from the processing in thefirst embodiment described with reference to FIG. 6 including step S21instead of step S15, not including step S17, and including steps S22 andS23 instead of steps S18 and S19 in case of Yes in step S11.

When determining that the add-on ECU 60 is connected to the filteringcontroller 50 (S11: Yes), the filtering controller 50 transmits thesensor data transmitted from the sensor domain 20 to the add-on ECU 60without transmitting the sensor data to the drive assist ECU 10 (S21).

After step S16 is executed, the add-on ECU 60 transmits the calculatedcontrol data to the filtering controller 50 (S22). That is, a differencefrom step S18 in the first embodiment includes that the drive assist ECU10 does not transmit control data. The filtering controller 50 transmitscontrol data from the add-on ECU 60 as control data from the driveassist ECU 10 to the control domains 30 and 40 (S23). That is, adifference from step S19 in the first embodiment includes that thecontrol data is not transmitted from the drive assist ECU 10, andtherefore the filtering controller 50 does not obtain and discard thecontrol data transmitted from the drive assist ECU 10.

In addition, similar to the first embodiment, in the second embodiment,communication protocols which are used to transmit data in the centralgateway 2 and are other than the CAN protocol may be also be adopted.

When, for example, a TCP/IP protocol is adopted, in the ROM 510, itemsof address data of the ECUs 201 and 202 of the sensor domain 20 are alsostored in advance as transmission addresses of a data frame which isobtained and whose transmission to the drive assist ECU 10 is prevented.Further, the CPU 504 transmits these items of address data to the framecapture 501. Thus, the frame capture 501 obtains items of sensor data ofthe ECUs 201 and 202 of the sensor domain 20 based on the address datatransmitted from the CPU 504.

Further, in the ROM 510, address data indicating a destination addressto be reconfigured to a data frame of sensor data is also stored. Thisdestination address is an address of the add-on ECU 60. Further, the CPU504 transmits this address data to a frame ID reconfiguring unit 502.Thus, the frame ID reconfiguring unit 502 changes the destinationaddress of the data frame of the sensor data obtained by the framecapture 501 from the address of the drive assist ECU 10 to the addressof the add-on ECU 60. Consequently, the sensor data is not transmittedto the drive assist ECU 10, and is transmitted only to the add-on ECU60. Consequently, in this case, the frame ID reconfiguring unit 502operates an address reconfiguring unit.

As described above, similar to the first embodiment, according to thesecond embodiment, it is possible to reduce an entire change amount ofthe drive assist network system 1 as much as possible, and update adrive assist function to an advanced drive assist function.

Third Embodiment

Next, a third embodiment will be described. The same contents as thosein the first embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals.

In the first embodiment, control data from a drive assist ECU 10 issimply discarded and only data of an add-on ECU 60 is transmitted tocontrol domains 30 and 40. However, in the third embodiment, a systemwhose safety is further improved is realized by effectively usingcontrol data from the drive assist ECU 10. More specifically, in thethird embodiment, a combination of the drive assist ECU 10 and theadd-on ECU 60 is regarded as a redundant system to perform failurediagnosis.

(Configuration of Drive Assist Network System 1 According to ThirdEmbodiment)

The configuration of the drive assist network system 1 according to thethird embodiment is the same as the configuration of the drive assistnetwork system 1 according to the first embodiment described withreference to FIG. 1. However, the drive assist network system 1according to the third embodiment differs from the drive assist networksystem 1 according to the first embodiment in the following operation.In addition, the third embodiment will be described assuming thattransmission in a central gateway 2 is performed according to a CANprotocol.

When determining control contents of an own car based on sensor data,the add-on ECU 60 determines based on the sensor data whether to use anexisting function or use an additional function since the existingfunction cannot support the control contents. In this regard, theexisting function is a function mounted on a drive assist function ofthe drive assist ECU 10 and a drive assist function of the add-on ECU60. Meanwhile, the additional function is a function which is mountedonly on the drive assist function of the add-on ECU 60, and which is notmounted on the drive assist function of the drive assist ECU 10.

In this regard, both of the drive assist function of the drive assistECU 10 and the drive assist function of the add-on ECU 60 are the sameas those in the first embodiment described with reference to FIGS. 7 and8. In this case, the add-on ECU 60 determines an emergency brake ascontrol contents of the own car in the example illustrated in FIG. 7,and determines an emergency performed while turning the steering ascontrol contents of the own car in the example illustrated in FIG. 8.Meanwhile, the drive assist function of the drive assist ECU 10 does notsupport steering control which is the additional function unlike theadd-on ECU 60. Hence, the drive assist ECU 10 determines the emergencybrake as control contents of the own car in both of the exampleillustrated in FIG. 7 and the example illustrated in FIG. 8. That is,the control contents of the own car determined by the drive assist ECU10 and the add-on ECU 60 match in the example illustrated in FIG. 7, andthe control contents of the own car determined by the drive assist ECU10 and the add-on ECU 60 do not match in the example illustrated in FIG.8.

Hence, for example, the add-on ECU 60 determines to use the existingfunction when the determined control contents of the own car includeonly a brake operation without a steering operation, and determines touse the additional function since the existing function cannot supportthe control contents when the determined control contents of the own carinclude a steering operation and include the brake operation, too.Further, the add-on ECU 60 sets determination result data indicatingwhether or not to use the existing function or use the additionalfunction, as a determination result to a data field of a data frameincluding control data. Consequently, the filtering controller 50 canrecognize whether to use the existing function or use the additionalfunction.

According to the third embodiment, when it is determined to use theexisting function, the filtering controller 50 compares control datafrom the drive assist ECU 10 and control data from the add-on ECU 60, sothat it is possible to check validity of the control data. This isbecause it is expected in this case that these items of control datamatch.

(Configuration of Filtering Controller 50 According to Third Embodiment)

Next, a configuration of a filtering controller 50 according to thethird embodiment will be described with reference to FIG. 11. Asillustrated in FIG. 11, upon comparison with the filtering controller 50according to the first embodiment described with reference to FIG. 3,the filtering controller 50 further includes a frame routing unit 505and a failure diagnosis module 506.

A frame capture 501 obtains a data frame including control data from thedrive assist ECU 10 and a data frame including control data from theadd-on ECU 60 yet transmits both of these data frames to the framerouting unit 505 without discarding the data frame from the drive assistECU 10 in the third embodiment. Hence, in the third embodiment, frame IDdata indicating a frame ID of the control data from the drive assist ECU10 is stored as a frame ID used for comparison in the ROM 510 of thefiltering controller 50 without discarding the frame ID.

The frame routing unit 505 determines whether to use the existingfunction (whether or not control data from the add-on ECU 60 is controldata calculated by the existing function) or use the additional function(whether or not the control data from the add-on ECU 60 is control datacalculated by the additional function). When it is determined to use theexisting function, the frame routing unit 505 transmits both of a dataframe from the drive assist ECU 10 and a data frame from the add-on ECU60 to the failure diagnosis module 506.

More specifically, the frame routing unit 505 can make the determinationbased on determination result data included in the data frames togetherwith the control data as described above. As described above, the add-onECU 60 determines whether to use the existing function or use theadditional function, and sets which function is used to calculatecontrol data, to determination result data. In this regard, the add-onECU 60 determines whether to use the existing function or use theadditional function at a timing for calculating control data, based onsensor data obtained from a sensor domain 20, and sets thisdetermination result to determination result data. Further, the framerouting unit 505 can determine whether to use the existing function anduse the additional function by reading this determination result data.

The failure diagnosis module 506 compares the items of control dataincluded in the data frames transmitted from the frame routing unit 505,and determines whether or not there is a difference between the items ofcontrol contents. Hence, the control data calculated by the drive assistECU 10 by using the existing function and control data calculated by theadd-on ECU 60 by using the existing function are compared. Hence, when afailure does not occur in the drive assist ECU 10 and the add-on ECU 60,and the both items of control data are normal, the both items of controldata match.

In this regard, when, for example, control data is command-based data,control data which needs to be compared can be specified by specifyingcontrol data indicating the same type of a command as control data whichneeds to be compared. In this case, the control data indicates, forexample, a control torque amount of a brake hydraulic pressure of abrake 422 and a turning angle of a steering 411 as command parameters.Hence, in this case, the failure diagnosis module 506 compares commandparameters to compare the items of control data.

(Processing of Filtering Controller 50)

Next, processing of the filtering controller 50 according to the thirdembodiment will be described with reference to FIG. 12.

The processing illustrated in FIG. 12 differs from the processing in thefirst embodiment described with reference to FIG. 5 in including step S4instead of step S1 and further including steps S5 and S6 at a subsequentstage of step S4.

Processing in step S4 differs from the processing in step S1 accordingto the first embodiment in defining a frame ID of control data from thedrive assist ECU 10, too, as a frame ID of an acquisition target dataframe which is not discarded. Hence, the frame capture 501 acquires dataframes of the control data from the drive assist ECU 10 and control datafrom the add-on ECU 60, and outputs the data frames to the frame routingunit 505.

The frame routing unit 505 determines whether to use the existingfunction or use the additional function (S5). When the additionalfunction is used (S5: No), the frame routing unit 505 does not outputthe data frame from the add-on ECU 60 (the data frame from the driveassist ECU 10, too) to the failure diagnosis module 506, and outputs thedata frame from the add-on ECU 60 to the frame ID reconfiguring unit502. Subsequently, similar to the first embodiment, a frame ID and a CRCof the control data from the add-on ECU 60 are changed, and the controldata is transmitted as the control data from the drive assist ECU 10 tothe control domains 30 and 40.

Meanwhile, when the existing function is used (S5: Yes), the framerouting unit 505 outputs both of the data frame from the drive assistECU 10 and the data frame from the add-on ECU 60, to the failurediagnosis module 506.

The failure diagnosis module 506 performs failure diagnosis by comparingthe items of control data included in the data frames outputted from theframe routing unit 505 (S6). The failure diagnosis module 506 comparesthe items of control data transmitted from the frame routing unit 505,and determines whether or not there is a difference between the items ofcontrol contents. In addition, strictly speaking, the items of controldata included in data fields of the data frames are compared. Thecontrol data calculated by the drive assist ECU 10 by using the existingfunction and the control data calculated by the add-on ECU 60 by usingthe existing function are compared. Hence, when a failure does not occurin the drive assist ECU 10 and the add-on ECU 60, and the both items ofcontrol data are normal, the both items of control data match.

When determining that the items of control data match, the failurediagnosis module 506 outputs the data frame from the add-on ECU 60 tothe frame ID reconfiguring unit 502. Subsequently, similar to the firstembodiment, a frame ID and a CRC of the control data from the add-on ECU60 are changed, and the control data is transmitted as the control datafrom the drive assist ECU 10 to the control domains 30 and 40.

Meanwhile, when the items of control data do not match, a failure of thedrive assist ECU 10 occurs, a failure of the add-on ECU 60 occurs or afailure of a channel to the failure diagnosis module 506 occurs, andtherefore at least one item of control data is abnormal. Hence, in thiscase, which control data is correct cannot be specified, so that thefiltering controller 50 notifies a driver of an error and notifies thedriver of that a failure is occurring in the drive assist network system1, and transfers a control right of the own car to the driver.

In this regard, an arbitrary output device may notify (output) thedriver of an error. The output device is, for example, a display device,an audio output device or a combination thereof. The display device maybe, for example, a display panel which displays images indicating errornotification contents, or may be a LED (Light Emitting Diode) whichsupports error notification. The audio output device is, for example, aspeaker which outputs an error notification sound or a warning sound.The filtering controller 50 outputs an error from the output device whenthe items of control data do not match.

(Processing of Drive Assist Network System 1 According to ThirdEmbodiment)

Next, processing of the drive assist network system 1 according to thethird embodiment will be described with reference to FIGS. 13 and 14.

The processing illustrated in FIG. 13 differs from the processing in thefirst embodiment described with reference to FIG. 6 in including stepsS31 to S34 instead of step S16 at a subsequent stage of step S15 andincluding steps S35 and S37 at the subsequent stage of step S18.

After step S15, the add-on ECU 60 determines whether to use the existingfunction or use the additional function (S31). When the additionalfunction is used (S31: Yes), the add-on ECU 60 uses the additionalfunction to calculate control data based on sensor data transmitted fromthe sensor domain 20 through the filtering controller 50, and setsdetermination result data indicating that the additional function isused, to a data field of a data frame of the control data (S32 and S33).Meanwhile, when it is determined to use the existing function (S31: No),the add-on ECU 60 uses the existing function to calculate control databased on sensor data transmitted from the sensor domain 20 through thefiltering controller 50 (S34). In addition, processing of calculatingcontrol data in steps S32 and S34 is distinguished and described.However, both steps are substantially the same as step S16 in the firstembodiment.

After step S18, the filtering controller 50 determines whether to usethe existing function or use the additional function (S35). That is, thefiltering controller 50 determines to use the additional function whenthe determination result data included in the data frame of the controldata indicates that the additional function is used, and determines touse the existing function when the determination result data indicatesthat the existing function is used.

When determining to use the existing function (S35: No), the filteringcontroller 50 determines whether or not a failure occurs in one of thedrive assist ECU 10 and the add-on ECU 60 (S36). That is, the filteringcontroller 50 compares the control data from the add-on ECU 60 and thecontrol data from the drive assist ECU 10, and determines that a failureoccurs in one of the drive assist ECU 10 and the add-on ECU 60 whenthese items of control data do not match. When determining that thefailure occurs in one of the drive assist ECU 10 and the add-on ECU 60occurs (S36: Yes), the filtering controller 50 transmits data notifyinga driver of an error, to an output device (S37).

Meanwhile, when determining to use the additional function (S35: Yes),and when determining that a failure does not occur in both of the driveassist ECU 10 and the add-on ECU 60 (S36: No), the filtering controller50 transmits the control data from the add-on ECU 60 as the control datafrom the drive assist ECU 10, to the control domains 30 and 40 (S19).

As described above, in the third embodiment, by further providing theframe routing unit 505 and the failure diagnosis module 506 to thefiltering controller 50 of the drive assist network system 1 and makingthe drive assist ECU redundant, failure diagnosis is realized bycomparing the outputs of the frame routing unit 505 and the failurediagnosis module 506. Consequently, it is possible to detect a failureof the drive assist ECU and notify the driver of an error and,consequently, improve function safety at a system level.

Fourth Embodiment

Next, the fourth embodiment will be described with reference to FIG. 15.The same contents as those in the first embodiment will be describedbelow while optionally omitting the contents by assigning the samereference numerals. In addition, the fourth embodiment will be describedassuming that the fourth embodiment is constructed based on the firstembodiment, yet may be constructed based on the third embodiment.

In the first embodiment, sensor data is transmitted to a drive assistECU 10 and an add-on ECU 60 through a central gateway 2. However, in thefourth embodiment, sensor data is transmitted to the drive assist ECU 10and the add-on ECU 60 without using the central gateway 2. In thisregard, when sensor data is transmitted as RAW data through the centralgateway 2, the data amount of the sensor data is enormous, and thereforeincreases a traffic in the central gateway 2 and causes a crash of a busband. Hence, although sensor data (or calculated distance data)subjected to primary processing is transmitted through the centralgateway 2, this transmission cannot help but occupying a certain busband. By contrast with this, by directly transmitting sensor data to thedrive assist ECU 10 and the add-on ECU 60 without using the centralgateway 2, it is possible to hedge such a situation.

(Configuration of Drive Assist Network System According to FourthEmbodiment)

A configuration of a drive assist network system 1 according to thefourth embodiment will be described with reference to FIG. 15. Asillustrated in FIG. 15, the drive assist network system 1 according tothe fourth embodiment differs from the drive assist network system 1according to the first embodiment described with reference to FIG. 1 inincluding a front camera module 210 and a radar module 220 instead of asensor domain 20 (a front camera ECU 201 and a radar ECU 202).

The front camera module 210, and the drive assist ECU 10 and the add-onECU 60 are connected according to communication standards such as LVDS(Low Voltage Differential Signaling) or Ethernet (registered trademark)AVB. The radar module 220, and the drive assist ECU 10 and the add-onECU 60 are connected according to communication standards such as a SPI(Serial Peripheral Interface).

The front camera module 210 transmits image data generated by the frontcamera 211 to the drive assist ECU 10 and the add-on ECU 60. The radarmodule 220 transmits measurement distance data generated by the radar221, to the drive assist ECU 10 and the add-on ECU 60. That is, in thefourth embodiment, RAW data is transmitted as sensor data to the driveassist ECU 10 and the add-on ECU 60.

The drive assist ECU 10 and the add-on ECU 60 determine control contentsof an own car based on the items of RAW data transmitted from the frontcamera module 210 and the radar module 220.

(Processing of Drive Assist Network System 1 According to FourthEmbodiment)

In addition, processing of the drive assist network system 1 accordingto the fourth embodiment is the same as the processing of the driveassist network system 1 according to the first embodiment described withreference to FIG. 6, and therefore will not be described.

Recently, an image recognition algorithm and a sensor Fusion techniquemake rapid advancement, and therefore it is possible to provide anadvanced drive assist function by adopting a newer image recognitionalgorithm and sensor Fusion technique in the add-on ECU 60.

According to the fourth embodiment, it is possible to construct a systemwhich can catch up with advancement of the image recognition algorithmand the sensor Fusion technique. When, for example, the front camera ECU201 and the radar ECU 202 are mounted as in the drive assist networksystem 1 according to the first embodiment and primary processing isperformed, not only the drive assist ECU 10 and the add-on ECU 60 butalso the primary processing of the front camera ECU 201 and the radarECU 202 need to be changed in response to advancement of the imagerecognition algorithm and the sensor Fusion technique. By contrast withthis, according to the fourth embodiment, by mounting the add-on ECU 60which adopts the new image recognition algorithm and sensor Fusiontechnique, it is possible to catch up with the advancement of the imagerecognition algorithm and the sensor Fusion technique.

(Modified Example of Fourth Embodiment)

A case where a front camera module 210 and a radar module 220 transmititems of RAW data to a drive assist ECU 10 and an add-on ECU 60 has beendescribed above. However, the present invention is not limited to this.For example, the front camera module 210 and the radar module 220 mayperform primary processing on image data and measurement distance datasimilar to a front camera ECU 201 and a radar ECU 202, and transmitobject data and calculated distance data to the drive assist ECU 10 andthe add-on ECU 60.

Further, even in this case, the front camera module 210 and the radarmodule 220 are not limited to generation of the completely same objectdata and calculated distance data as those of the front camera ECU 201and the radar ECU 202. The front camera module 210 and the radar module220 may generate intermediate data closer to RAW data as the object dataand the calculated distance data. For example, disparity data obtainedfrom a stereo camera or flow vector information (optical flow) may begenerated as the intermediate data of the image data and the objectdata.

Fifth Embodiment

Next, the fifth embodiment will be described. The same contents as thosein the first embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals. Inaddition, the fifth embodiment will be described assuming that the fifthembodiment is constructed based on the first embodiment. However, thefifth embodiment is not limited to this, and can also be constructedbased on one of the second to fourth embodiments.

Contends described in the first to fourth embodiments are applicable toa system other than an in-vehicle system as long as the system employs acentral gateway configuration and performs “recognition, determinationand control” as a basic operation. In the fifth embodiment, a case wherethe above contents are applied to an intelligent robot 3 will bedescribed as a first application example. A basic configuration of theintelligent robot 3 employs a configuration of “recognition,determination and control” and is the same as the basic configuration ofan in-vehicle drive assist network system 1.

(Configuration of Intelligent Robot 3 According to Fifth Embodiment)

A configuration of the intelligent robot 3 according to the fifthembodiment will be described with reference to FIG. 16. As illustratedin FIG. 16, the intelligent robot 3 according to the fifth embodimentincludes a central gateway 2, a behavior control ECU 11, a sensor unit21, an actuator control unit 31, a filtering controller 50 and an add-onECU 61.

The behavior control ECU 11 differs from a drive assist ECU 10 accordingto the first embodiment in calculating control data indicating controlcontents of actuators 321 to 323 of the intelligent robot 3 instead ofcalculating control data of a car based on sensor data. The behaviorcontrol ECU 11 transmits the generated control data to the actuatorcontrol unit 31 through the central gateway 2 (filtering controller 50).

The sensor unit 21 includes a camera 231, a microphone (also referred toas a “microphone” below) 232 and various sensors 233. The sensor unit 21performs primary processing on items of data transmitted from the camera231, the microphone 232 and the various sensors 233, and transmits theitems of data as items of sensor data to the behavior control ECU 11 andthe add-on ECU 61 through the central gateway 2 (filtering controller50).

The camera 231 captures an image of the surroundings of the intelligentrobot 3. The camera 231 generates image data indicating the image of thesurroundings of the intelligent robot 3 by capturing the image of thesurroundings of the intelligent robot 3, and transmits the image data tothe sensor unit 21.

The microphone 232 receives an input of an audio in the surroundings ofthe intelligent robot 3. The microphone 232 generates audio dataindicating an inputted audio, and transmits the audio data to the sensorunit 21.

The various sensors 233 detect other contents of the intelligent robot3. That is, at least one sensor which detects arbitrary contents otherthan an image and an audio may be provided to the intelligent robot 3.For example, as the various sensors 233, a radar which measures adistance between the surroundings of the intelligent robot 3 and anobstacle may be provided to the intelligent robot 3, and a rotaryencoder which detects a rotary angle of each of the actuators 321 to 323of the intellectual robot 3 may be provided to the intellectual robot 3.The various sensors 233 generate data indicating the detected contents,and transmits the data to the sensor unit 21.

The actuator control unit 31 includes the head actuator 321, the armactuator 322 and the leg actuator 323. The actuator control unit 31controls each of the actuators 321 to 323 based on control datatransmitted from the behavior control ECU 11 and the add-on ECU 61.

The head actuator 321 is an actuator which is provided to a head of theintelligent robot 3. The actuator control unit 31 drives the headactuator 321 to turn the head of the intelligent robot 3.

The arm actuator 322 is an actuator which is provided to the arm of theintelligent robot 3. The actuator control unit 31 drives the armactuator 322 to operate an arm of the intelligent robot 3. Consequently,for example, the intelligent robot 3 can grab and carry an object in thesurroundings. The intelligent robot 3 has, for example, the arm actuator322 at each joint of the arm.

The leg actuator 323 is an actuator which is provided to a leg of theintellectual robot 3. The actuator control unit 31 drives the legactuator 323, so that the intelligent robot 3 walks. The intelligentrobot 3 has, for example, the leg actuator 323 at each joint of the leg.Further, the leg actuator 323 is not limited to this. For example, theintelligent robot 3 may be a robot which runs using wheels instead of awalking robot. In this case, the leg actuator 323 is an actuator whichdrives the wheels to rotate.

The add-on ECU 61 differs from an add-on ECU 60 according to the firstembodiment in calculating control data indicating control contents ofthe actuators 321 to 323 of the intelligent robot 3 instead ofcalculating control data of the car based on sensor data. The add-on ECU61 transmits the generated control data to the actuator control unit 31through the central gateway 2 (filtering controller 50).

(Processing of Intelligent Robot 3 According to Fifth Embodiment)

In addition, processing of the intelligent robot 3 according to thefifth embodiment is the same as the processing of the drive assistnetwork system. 1 according to the first embodiment described withreference to FIG. 6, and therefore will not be described. That is,according the processing of the drive assist network system 1 accordingto the first embodiment, a drive assist ECU 10 is replaced with thebehavior control ECU 11, and the add-on ECU 60 is replaced with theadd-on ECU 61.

The behavior control ECU 11 corresponds to a brain in terms of a person,and has very high arithmetic operation performance and therefore canperform more advanced control. This arithmetic operation performance isproportional to development of a semiconductor process and an increasein a speed of the frequency, and therefore develops very fast. However,the sensor unit 21 and the actuator control unit 31 are developed slowerthan the behavior control ECU 11. In view of such a background, thebehavior control ECU 11 having high arithmetic operation performance isnecessary to cause the intelligent robot 3 created first to perform amore advanced operation.

By contrast with this, according to the fifth embodiment describedabove, by additionally mounting a behavior control ECU which has higharithmetic operation performance and on which a new function is mountedas the add-on ECU 61 which is an add-on behavior control ECU, the add-onECU 61 instead of the existing behavior control ECU 11 can control theintelligent robot 3 without changing control contents of other blocks.Consequently, it is possible to improve the functions of the intelligentrobot 3.

Thus, an application target of the drive assist network system 1according to the first to fourth embodiments is not limited to a caralone, and is applicable to a moving object such as a car, a robot or aninverted two-wheel which moves under control of the drive assist networksystem 1.

Sixth Embodiment

Next, the sixth embodiment will be described. The same contents as thosein the first embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals. Inaddition, the sixth embodiment will be described assuming that the sixthembodiment is constructed based on the first embodiment. However, thesixth embodiment is not limited to this, and can also be constructedbased on one of the second to fourth embodiments.

In the sixth embodiment, a case where a system is applied to “Internetof Things” in cloud business will be described as a second applicationexample to a system than an in-vehicle system. “Internet of Things” alsoperform “recognition, determination and control” as a basic operation.Further, in the sixth embodiment, a rise warning system 4 for a riverwill be described as a specific example of the “Internet of Things”.

When there is a great amount of rain such as torrential rain inmountains, the rain from the mountains concentrates and flows to ariver, and then a rapid rise in a river water level endangers peopleplaying near the mouth of the river. The rise warning system 4determines a rapid rise in this river water level and the amount ofrainfall based on data of sensors installed at the mountains and theriver, and predicts the river water level. If a dangerous rise in thewater level is predicted, a warning device installed at the amount ofthe river is activated. Consequently, people at the mount of the rivercan safely evacuate.

(Configuration of Warning System 4 According to Sixth Embodiment)

A configuration of the rise warning system 4 according to the sixthembodiment will be described with reference to FIG. 17. As illustratedin FIG. 17, the rise warning system 4 according to the sixth embodimentincludes a gateway 5, an existing warning prediction determining device12, a sensor 22, a water level rise warning device 32 and an add-onwarning prediction determining device 62.

The gateway 5 includes a filtering controller 50, and performs the sameoperation as that of a central gateway 2 according to the firstembodiment. In this regard, in the sixth embodiment, the gateway 5corresponds to a gateway which relays data transmitted and receivedbetween a first network connected with the sensor 22 and the water levelrise warning device 32 and a second network connected with the existingwarning prediction determining device 12 and the add-on warningprediction determining device 62. For example, the first network is theInternet, and the second network is a LAN (Local Area Network).

The existing warning prediction determining device 12 differs from adrive assist ECU 10 according to the first embodiment in calculatingcontrol data indicating control contents of the water level rise warningdevice 32 based on sensor data from the sensor 22 instead of calculatingcontrol data of a car based on sensor data. The existing warningprediction determining device 12 transmits the generated control data tothe water level rise warning device 32 through the gateway 5 (filteringcontroller 50). The existing warning prediction determining device 12is, for example, a server or a supercomputer.

The sensor 22 is a water level sensor which measures a rainfall amountsensor which measures a rainfall amount or a water level sensor whichmeasures a river water level. The sensor 22 generates rainfall amountdata indicating the measured rainfall amount or water level dataindicating the measured river water level, and transmits the rainfallamount data or the river water level data as sensor data to the existingwarning prediction determining device 12 and the add-on warningprediction determining device 62 through the gateway 5 (filteringcontroller 50).

The water level rise warning device 32 notifies users of a danger of ariver based on control data transmitted from the existing warningprediction determining device 12 and the add-on warning predictiondetermining device 62. The water level rise warning device 32 includesat least one of a siren, an electric message board and a flashing light,and notifies users of a danger of a river thereby. When the water levelrise warning device 32 includes a siren, control data is data forindicating a siren rumbling operation. When the water level rise warningdevice 32 includes the electric message board, control data is data forinstructing an indication on an electronic message board. In this case,the control data may include data of characters to be displayed on theelectric message board. When the water level rise warning device 32includes a flashing light, the control data is data for instructing anoperation of the flashing light.

The add-on warning prediction determining device 62 differs from theadd-on ECU 60 according to the first embodiment in calculating controldata indicating control contents of the water level rise warning device32 based on sensor data from the sensor 22 instead of calculatingcontrol data of the car based on the sensor data. The add-on warningprediction determining device 62 transmits the generated control data tothe water level rise warning device 32 through the gateway 5 (filteringcontroller 50). The add-on warning prediction determining device 62 is,for example, a server or a supercomputer.

(Processing of Rise Warning System 4 According to Sixth Embodiment)

In addition, processing of the rise warning system 4 according to thesixth embodiment is the same as the processing of a drive assist networksystem. 1 according to the first embodiment described with reference toFIG. 6, and therefore will not be described. That is, in the processingof the drive assist network system 1 according to the first embodiment,the drive assist ECU 10 is replaced with the existing warning predictiondetermining device 12, and the add-on ECU 60 is replaced with the add-onwarning prediction determining device 62.

The rise warning system 4 can be also configured to model sensor data,predict and determine a phenomenon which occurs next while analyzing andlearning the sensor data, and perform control. In this case, an elementof the rise warning system. 4 which performs analysis, learning,prediction and determination is an important function, and is requiredto have very high arithmetic operation performance. By contrast withthis, according to the sixth embodiment, by mounting the latest serveror supercomputer on which advanced arithmetic operation performance ismounted as the add-on warning prediction determine device 62, it ispossible to improve the function of the rise warning system 4 withoutchanging an existing portion (a portion which collects data, gives acommand and performs control).

Even when, for example, a new water level prediction determiningalgorithm is devised, if arithmetic operation processing cannot catch upand cannot be performed quickly due to restriction of hardware of theexisting warning prediction determining device 12, it is possible toupgrade a function without influencing the existing function by addingthe add-on warning prediction determining device 62 having higherarithmetic operation processing performance than that of the existingwarning prediction determining device 12.

Further, according to the sixth embodiment, when the add-on warningprediction determining device 62 detects a failure in the add-on warningprediction determining device 62, a failure may be notified to thefiltering controller 50. Further, when notified of a failure from theadd-on warning prediction determining device 62, the filteringcontroller 50 may disable the add-on warning prediction determiningdevice 62 and enable the existing warning prediction determining device12. Thus, the filtering controller 50 may monitor a failure state of theadd-on warning prediction determining device 62.

In addition, the existing warning prediction determining device 12 andthe add-on warning prediction determining device 62 which are installedat the LAN yet are not limited to these. For example, each of theexisting warning prediction determining device 12 and the add-on warningdetermining device 62 may be a blade (board server) mounted on a bladeserver instead of an individual housing. Further, the gateway 5 may benot only another housing but also a blade (board server) mounted on thegateway 5.

Seventh Embodiment

Next, the seventh embodiment will be described. The same contents asthose in the third embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals. Inaddition, the seventh embodiment will be described assuming that theseventh embodiment is constructed based on the third embodiment.However, the seventh embodiment can be also constructed based on one ofthe fourth to sixth embodiments.

In the seventh embodiment, a mode of using functions of OBDs(On-Board-Diagnostics) when the OBDs are mounted on a drive assist ECU10 and an add-on ECU 60 will be described. In the third embodiment, afiltering controller 50 detects a failure by comparing items of controldata, and performs processing matching the failure. However, in thesixth embodiment, processing is performed according to results of theOBDs of the drive assist ECU 10 and the add-on ECU 60.

(Configuration of Drive Assist Network System 1 According to SeventhEmbodiment)

A configuration of a drive assist network system 1 according to theseventh embodiment is the same as the configuration of the drive assistnetwork system 1 according to the third embodiment. However, the driveassist network system. 1 according to the seventh embodiment differsfrom the drive assist network system 1 according to the third embodimentin the following operation.

The drive assist ECU 10 and the add-on ECU 60 respectively have the OBDfunctions. That is, the drive assist ECU 10 and the add-on ECU 60 havefailure self-diagnosis functions, and diagnose failures in the driveassist ECU 10 and the add-on ECU 60. In addition, according to thisfailure diagnosis, any item may be diagnosed as long as failures in thedrive assist ECU 10 and the add-on ECU 60 can be detected. For example,the drive assist ECU 10 and the add-on ECU 60 may detect any abnormalityamong various types of abnormalities such as a voltage abnormality and aclock abnormality. When detecting failures in the drive assist ECU 10and the add-on ECU 60, the drive assist ECU 10 and the add-on ECU 60transmit failure notification data for notifying the failures in thedrive assist ECU 10 and the add-on ECU 60, to the filtering controller50.

(Configuration of Filtering Controller 50 According to SeventhEmbodiment)

Next, a configuration of the filtering controller 50 according to theseventh embodiment will be described with reference to FIG. 18. Asillustrated in FIG. 18, the filtering controller 50 differs from thefiltering controller 50 according to the third embodiment described withreference to FIG. 11 in not including a failure diagnosis module 506.

A frame capture 501 acquires items of failure notification datatransmitted from the drive assist ECU 10 and the add-on ECU 60. When theframe capture 501 acquires the items of failure notification data, theframe routing unit 505 prevents transmission of the control data fromthe drive assist ECU 10 or the add-on ECU 60 which has transmitted thefailure notification data, and notifies a driver of an error. An errornotifying method is the same as that of the third embodiment, andtherefore will not be described.

(Processing of Drive Assist Network System 1 According to SeventhEmbodiment)

Next, processing of the drive assist network system 1 according to theseventh embodiment will be described with reference to FIG. 19.

The processing illustrated in FIG. 19 differs from the processing in thethird embodiment described with reference to FIGS. 13 and 14 inincluding step S16 at a subsequent stage of step S15 instead of stepsS31 to 34, and including steps S41 to S43 at a subsequent stage of stepS18 instead of steps S35 and 36.

After step S18, the filtering controller 50 determines whether or notthe failure notification data is received from the add-on ECU 60 (S41).When the failure notification data is not received from the add-on ECU60 (S41: No), step S19 is executed. Meanwhile, when the failurenotification data is received from the add-on ECU 60 (S41: Yes), thefiltering controller 50 determines whether or not the failurenotification data is received from the drive assist ECU 10 (S42).

When the failure notification data is not received from the drive assistECU 10 (S42: No), the filtering controller 50 discards the control datafrom the add-on ECU 60, and transmits the control data from the driveassist ECU 10, to control domains 30 and 40 (S43). In this case, evenwhen a frame ID reconfiguring unit 502 reconfigures a frame ID, a frameID of a data frame does not change and does not matter. However,preferably, the frame ID reconfiguring unit 502 does not reconfigure aframe ID so as not to execute extra processing. When the failurenotification data is received from the drive assist ECU 10 (S42: Yes),step S37 is executed. In addition, the drive assist ECU 10 can alsocontinue control when the control data from the drive assist ECU 10 istransmitted to the control domains 30 and 40 in step S43. However, thereis a notification of a failure from the add-on ECU 60, and therefore, anerror may be notified in the same way as in step S37.

As described above, according to the seventh embodiment, in which ECU afailure occurs can be specified based on an OBD result, so that it ispossible to realize a minimum continuous operation.

Eighth Embodiment

Next, the eighth embodiment will be described. The same contents asthose in the third embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals. Inaddition, the eighth embodiment will be described assuming that theeighth embodiment is constructed based on the third embodiment. However,the eighth embodiment can be also constructed based on one of the fourthto sixth embodiments.

In the third embodiment, an example where a drive assist network system1 includes one add-on ECU has been described. However, a plurality ofadd-on ECUs may be provided. In the eighth embodiment, an example wherea plurality of add-on ECUs are provided will be described.

(Configuration of Drive Assist Network System 1 According to EighthEmbodiment)

A configuration of the drive assist network system 1 according to theeighth embodiment will be described with reference to FIG. 20. Asillustrated in FIG. 20, the drive assist network system 1 according tothe third embodiment differs from the drive assist network system 1according to the third embodiment in further including an add-on ECU 70.The add-on ECU 70 is a drive assist ECU whose configuration andoperation are the completely same as those of the add-on ECU 60.

Hence, in the eighth embodiment, sensor data from a sensor domain 20 istransmitted to a drive assist ECU 10 and an add-on ECU 60 and, inaddition, to the add-on ECU 70, too. The add-on ECU 70 transmits controldata generated based on the sensor data, to a power train domain 30 anda chassis domain 40 through a filtering controller 50.

(Configuration of Filtering Controller 50 According to EighthEmbodiment)

A configuration of the filtering controller 50 according to the eighthembodiment is the same as the configuration of the filtering controller50 according to the third embodiment. However, the filtering controller50 according to the eighth embodiment differs from the filteringcontroller 50 according to the third embodiment in the followingoperation.

A frame capture 501 differs from the frame capture 501 according to thethird embodiment in acquiring a data frame including control data fromthe drive assist ECU 10 and a data frame including control data from theadd-on ECU 60 and, in addition, a data frame including control data fromthe add-on ECU 70, and transmits the data frames to a frame routing unit505.

Hence, a CPU 504 notifies the frame capture 501 of a frame ID of thecontrol data from the add-on ECU 70, too, as a frame ID of a data frameacquired to use for data comparison performed upon failure diagnosis.That is, in a ROM 510 included in the filtering controller 50, frame IDdata indicating the control data from the add-on ECU 70 is also storedin advance as a frame ID of a data frame used for comparison. Thus, theframe capture 501 acquires the data frame from the add-on ECU 70, too,based on frame ID data acquired by the CPU 504 from the ROM 510 andtransmitted, and transmits the data frame to the frame routing unit 505.

When determining to use an additional function based on determinationresult data included in the data frames from the add-on ECUs 60 and 70,the frame routing unit 505 transmits the data frame from the add-on ECU60 and the data frame from the add-on ECU 70 to the failure diagnosismodule 506. Meanwhile, when determining to use an existing functionbased on the determination result data included in the data frames fromthe add-on ECUs 60 and 70, the frame routing unit 505 transmits all ofthe data frame from the drive assist ECU 10, the data frame from theadd-on ECU 60 and the data frame from the add-on ECU 70, to a failurediagnosis module 506. In addition, the frame routing unit 505 may referto only determination result data included in one of the data framesfrom the add-on ECUs 60 and 70, and determine whether to use theadditional function or use the existing function.

The failure diagnosis module 506 compares the items of control dataincluded in the data frames transmitted from the frame routing unit 505.Hence, when the items of control data from the add-on ECUs 60 and 70 arethe items of control data calculated by the additional function, thefailure diagnosis module 506 compares the control data from the add-onECU 60 and the control data from the add-on ECU 70. When the items ofcontrol data match, the failure diagnosis module 506 transmits one ofthe data frame of the add-on ECU 60 and the data frame from the add-onECU 70 to the frame ID reconfiguring unit 502. When the items of controldata do not match, an error is notified to a driver. The error notifyingmethod is the same as that in the third embodiment, and therefore willnot be described.

Meanwhile, when the items of control data from the add-on ECUs 60 and 70are the items of control data determined by the existing function, thefailure diagnosis module 506 performs tripartite comparison between thecontrol data from the drive assist ECU 10, the control data from theadd-on ECU 60 and the control data from the add-on ECU 70. When theitems of control data match, the failure diagnosis module 506 transmitsone of the data frame from the add-on ECU 60 and the data frame from theadd-on ECU 70, to a frame ID reconfiguring unit 502. When two items ofthe items of control data do not match, the failure diagnosis module 506transmits one of the two data frames whose failures have not beenspecified by the tripartite comparison, to the frame ID reconfiguringunit 502. That is, consequently, control data whose normality has beendetermined by a majority vote is transmitted to a transmissiondestination.

(Processing of Drive Assist Network System 1 According to EighthEmbodiment)

Next, the processing of the drive assist network system 1 according tothe eighth embodiment will be described with reference to FIGS. 21 and22.

The processing illustrated in FIGS. 21 and 22 differs from theprocessing in the third embodiment described with reference to FIGS. 13and 14 in including steps S19, S37, and S51 to S53 at a subsequent stageof step S35 instead of steps S19, S36 and S37.

When determining to use the additional function (S35: Yes), thefiltering controller 50 determines whether or not a failure occurs inone of the add-on ECU 60 and the add-on ECU 70 (S51). That is, thefiltering controller 50 compares the control data from the add-on ECU 60and the control data from the add-on ECU 70, and determines that afailure occurs in one of the add-on ECU 60 and the add-on ECU 70 whenthese items of control data do not match. When determining that thefailure occurs in one of the add-on ECU 60 and the add-on ECU 70 (S51:Yes), the filtering controller 50 notifies the driver of an error (S37).

When determining to use the existing function (S35: No), the filteringcontroller 50 determines whether or not a failure occurs in one of thedrive assist ECU 10, the add-on ECU 60 and the add-on ECU 70 (S52). Thatis, the filtering controller 50 compares the control data from theadd-on ECU 60, the control data from the add-on ECU 70 and the controldata from the drive assist ECU 10, and determines that a failure occurswhen the two items of control data do not match. When determining thatthe failure occurs (S52: Yes), the filtering controller 50 transmits oneof the two items of control data whose failures have not been specifiedby tripartite comparison, to the control domains 30 and 40.

Meanwhile, when determining that a failure does not occur (S51: No andS52: No), the filtering controller 50 transmits the control data fromone of the add-on ECUs 60 and 70 as the control data from the driveassist ECU 10 to the control domains 30 and 40 (S19).

As described above, according to the eighth embodiment, by makingredundant the drive assist functions of not only the existing functionsmounted on all of the drive assist ECU 10 and the add-on ECUs 60 and 70but also the additional functions mounted only on the add-on ECUs 60 and70, it is possible to diagnose a failure by comparing outputs of thesefunctions. Consequently, it is possible to further improve functionsafety at a system level.

Ninth Embodiment

Next, the ninth embodiment will be described. The same contents as thosein the third embodiment will be described below while optionallyomitting the contents by assigning the same reference numerals. Inaddition, the ninth embodiment will be described assuming that the ninthembodiment is constructed based on the third embodiment. However, theninth embodiment can be also constructed based on one of the fourth toeighth embodiments.

In the above-described embodiments, an example where a central gateway 2includes all functions of a filtering controller 50 has been described.However, an add-on ECU 60 may have part of these functions. This modewill be described in the ninth embodiment.

(Configuration of Drive Assist Network System 1 According to NinthEmbodiment)

A configuration of a drive assist network system 1 according to theninth embodiment will be described with reference to FIG. 23. Asillustrated in FIG. 23, the drive assist network system 1 according tothe ninth embodiment differs from the same drive assist network systemaccording to the third embodiment as that in FIG. 1 in that the centralgateway 2 does not include all functions of the filtering controller 50and includes only a frame capture 501. Further, the difference includesthat an add-on ECU 60 includes a frame ID reconfiguring unit 502, a CRCencoder 503, a CPU 504, a frame routing unit 505, a failure diagnosismodule 506, a ROM 510 and an add-on functioning unit 601.

The frame capture 501 differs from the frame capture 501 according tothe third embodiment in acquiring a data frame including control datatransmitted from a drive assist ECU 10 without acquiring a data frameincluding control data transmitted from the add-on ECU 60 andtransmitting the acquired data frame to the frame routing unit 505. Forexample, similar to the third embodiment, the central gateway 2 includesa ROM (not illustrated) in which frame ID data indicating a frame ID ofthe drive assist ECU 10 is stored, and a CPU (not illustrated), and theCPU notifies the frame capture 501 of the frame ID of the drive assistECU 10 to enable the frame capture 501 to acquire the control data fromthe drive assist ECU 10. In addition, when the add-on ECU 60 is notconnected to the central gateway 2 (frame capture 501), the framecapture 501 does not acquire the data frame from the drive assist ECU 10and transmits the data frame as is to a transmission destination.

Further, FIG. 23 illustrates the add-on functioning unit 601 as anelement of the add-on ECU 60 which generates control data based onsensor data. The add-on functioning unit 601 transmits the data frameincluding the generated control data to the frame routing unit 505. Theprocessing subsequent to the processing of the frame routing unit 505 isthe same as that in the third embodiment. Hence, in the ninthembodiment, the data frame transmitted from the add-on ECU 60 is nottransmitted through the frame capture 501, so that the frame capture 501does not need to acquire the data frame from the add-on ECU 60. Further,in the ROM 510, only frame ID data 513 indicating a frame ID newly setto a data frame among items of frame IDs 511 to 513 may be stored.

(Processing of Drive Assist Network System 1 According to NinthEmbodiment)

In addition, processing of the drive assist network system 1 accordingto the ninth embodiment is the same as the processing of the driveassist network system 1 according to the third embodiment described withreference to FIGS. 13 and 14, and therefore will not be described. Inthis regard, a difference includes that items of control data from thedrive assist ECU 10 and the add-on ECU 60 (add-on functioning unit 601)are transmitted to the frame routing unit 505 instead of the filteringcontroller 50 in step S18.

As described above, according to the ninth embodiment, most of necessarycomponents of the filtering controller 50 are realized by the add-on ECU60. Consequently, it is possible to suppress a change amount of theexisting central gateway.

Tenth Embodiment

In this regard, one embodiment extracted from the above-described firstto ninth embodiments will be described as the tenth embodiment withreference to FIG. 24. As illustrated in FIG. 24, a control system 9according to the tenth embodiment includes a first control instructiondevice 91, an observing device 92, a movement control device 93, asecond control instruction device 94 and a relay device 95. The controlsystem 9 is a system mounted on a moving object.

The first control instruction device 91 determines control contentsbased on observation result data transmitted from an observing device,and transmits first control data indicating the determined controlcontents. The first control instruction device 91 corresponds to a driveassist ECU 10, a behavior control ECU 11 and an existing warningprediction determining device 12.

The observing device 92 observes surroundings of the moving object, andtransmits observation result data indicating an observation result. Theobserving device 92 corresponds to a sensor domain 20 (a frame cameraECU 201 and a radar ECU 202), a front camera module 210, a radar module220, a sensor unit 21 (a camera 231, a microphone 232 and varioussensors 233) and a sensor 22.

The movement control device 93 controls movement of the moving object.The movement control device 93 corresponds to a power train domain 30(engine control ECU 301), a chassis domain 40 (a steering control ECU401 and an accelerator control ECU 402), an actuator control unit 31 (ahead actuator 321, an arm actuator 322 and a leg actuator 323) and awater level rise warning device 32.

The second control instruction device 94 determines control contentsbased on the observation result data, and transmits second dataindicating the determined control contents. The second controlinstruction device 94 corresponds to an add-on ECU 60, an add-on ECU 61,an add-on warning prediction determining device 62 and an add-on ECU 70.

According to a first aspect, the relay device 95 relays the firstcontrol data transmitted from the first control instruction device 91,to the movement control device 93. Further, when the second controlinstruction device 94 is provided to the control system 9, the relaydevice 95 transmits the second control data instead of the first controldata to the movement control device 93. The relay device 95 correspondsto a filtering controller 50.

According to a second aspect, the relay device 95 relays the observationresult data transmitted from the observing device 92 to the firstcontrol instruction device 91. Further, when the second controlinstruction device 94 is provided to the control system 9, the relaydevice 95 transmits the observation result data to the second controlinstruction device 94 instead of the first control instruction device91. The relay device 95 corresponds to the filtering controller 50.

According to the above-described embodiment, it is not necessary to makein advance a mechanism which assumes addition of the second controlinstruction device 94, in the observing device 92 and the movementcontrol device 93, and, only by adding the second control instructiondevice 94 to the control system 9, the second control instruction device94 instead of the first control instruction device 91 can performcontrol. Consequently, it is possible to mount on the control system 9the second control instruction device 94 which is added as a function tothe first control instruction device 91 without changing peripheraldevices 92 and 93 in advance and, consequently easily update thefunction.

The invention invented by the inventors has been specifically describedbased on the embodiments. However, the present invention is not limitedto the above-described embodiments and can be variously changed withoutdeparting from the spirit of the invention.

A storage unit in which frame ID data or address data is stored in thefiltering controller 50 is not limited to the ROM 510. For example, thestorage unit may be configured to include arbitrary one of non-volatilememory devices such as the ROM 510 (e.g. a flash ROM), an EEPROM(Electrically Erasable Programmable Read-Only Memory) and a hard disk.

Further, in the third embodiment, in step S36, when control data fromthe drive assist ECU 10 and control data from the add-on ECU 60 match,the control data from the add-on ECU 60 is transmitted to a transmissiondestination. However, the present invention is not limited to this. Forexample, the control data from the drive assist ECU 10 may betransmitted to the transmission destination. This is the same when allitems of control data match in step S52 in the eighth embodiment.

Further, in the first to ninth embodiments, cases where one front camera211 and one radar 2221 are installed to face forward have beendescribed. However, the present invention is not limited to this.Further, the front cameras 211 and the radars 221 may be provided toface toward sides and the rear of a car or a robot 3.

Part or entirety of the first to ninth embodiments can be also describedas in the following supplementary notes.

(Supplementary Note 1)

A control system that is mounted on a moving object includes:

an observing device that observes surroundings of the moving object andtransmits observation result data indicating an observation result;

a first control instruction device that determines control contentsbased on the observation result data transmitted from the observingdevice, and transmits first control data indicating the determinedcontrol contents;

a movement control device that controls movement of the moving object;and

a relay device that relays the observation result data transmitted fromthe first control instruction device, to the first control instructiondevice, and

when a second control instruction device that the determines controlcontents based on the observation result data and transmits secondcontrol data indicating the determined control contents is provided tothe control system, the relay device transmits the observation resultdata, to the second control instruction device instead of the firstcontrol instruction device.

(Supplementary Note 2)

In the control system described in Supplementary Note 1, the firstcontrol data and the second control data are data frames that complywith a CAN protocol, and

the relay device further relays the second control data transmitted fromthe second control instruction device, to the movement control device,and changes a frame ID of the data frame of the second control data fromthe frame ID of the second control data to a frame ID of the firstcontrol data.

(Supplementary Note 3)

In the control system described in Supplementary Note 2, the relaydevice calculates a CRC value based on the data frame of the changedframe ID, and sets the calculated CRC value to the data frame of thechanged frame ID.

(Supplementary Note 4)

In the control system described in Supplementary Note 3, the movingobject is a car, and

the first control instruction device and the second control instructiondevice determine the control contents to hedge an obstacle in thesurroundings of the car.

(Supplementary Note 5)

A relay device that relays data to be transmitted and received in amoving object, includes:

a first relaying unit that receives observation result data indicatingan observation result of surroundings of the moving object, from anobserving device and relays the observation result data to a firstcontrol instruction device that determines control contents of themoving object based on the observation result data; and

a second relaying unit that receives first control data indicating thecontrol contents of the moving object, from the first controlinstruction device, and relays the first control data to a movementcontrol device that controls the moving object, and

when a second control instruction device that determines controlcontents based on the relayed observation result data and transmitssecond control data indicating the determined control contents isprovided to the moving object, the first relaying unit transmits theobservation result data to the second control instruction device insteadof the first control instruction device.

(Supplementary Note 6)

A control method that is performed in a moving object, includes:

a first transmitting step of, at an observing device, observingsurroundings of the moving object, and transmitting observation resultdata indicating an observation result;

a relaying step of relaying the observation result data transmitted fromthe first control instruction device, to a first control instructiondevice;

a second transmitting step of, at the first control instruction device,determining control contents of the moving object based on thetransmitted observation result data, and transmitting first control dataindicating the determined control contents; and

a controlling step of, at a movement control device, controllingmovement of the moving object based on the transmitted control data, and

when a second control instruction device that determines controlcontents based on the observation result data and transmits secondcontrol data indicating the determined control contents is provided tothe moving object, the observation result data is transmitted to thesecond control instruction device instead of the first controlinstruction device in the relaying step.

While the invention has been described in terms of several embodiments,those skilled in the art will recognize that the invention can bepracticed with various modifications within the spirit and scope of theappended claims and the invention is not limited to the examplesdescribed above.

Further, the scope of the claims is not limited by the embodimentsdescribed above.

Furthermore, it is noted that, Applicant's intent is to encompassequivalents of all claim elements, even if amended later duringprosecution.

The first and ninth embodiments can be combined as desirable by one ofordinary skill in the art.

What is claimed is:
 1. A control system that is mounted on a movingobject comprising: an observing device that observes surroundings of themoving object and transmits observation result data indicating anobservation result; a first control instruction device that determinescontrol contents based on the observation result data, and transmitsfirst control data indicating the determined control contents; amovement control device that controls movement of the moving object; anda relay device that determines whether a second control instructiondevice is provided to the control system, wherein the second controlinstruction device determines control contents based on the observationresult data and transmits second control data indicating the determinedcontrol contents, wherein the relay device relays the first control datatransmitted from the first control instruction device to the movementcontrol device when it is determined that the second control instructiondevice is not provided to the control system, wherein when it isdetermined that the second control instruction device is provided to thecontrol system, the relay device relays the second control datatransmitted from the second control instruction device instead of thefirst control data to the movement control device, and wherein when itis determined that the second control instruction device is provided tothe control system, the relay device transmits the observation resultdata received from the observing device to both the first controlinstruction device and the second control instruction device, receivesthe first control data from the first control instruction device and thesecond control data from the second control instruction device,respectively, discards the received first control data and transmits thereceived second control data to the second control instruction device.2. A control system that is mounted on a moving object comprising: anobserving device that observes surroundings of the moving object andtransmits observation result data indicating an observation result; afirst control instruction device that determines control contents basedon the observation result data transmitted from the observing device,and transmits first control data indicating the determined controlcontents; a movement control device that controls movement of the movingobject; and a relay device that determines whether a second controlinstruction device is provided to the control system, wherein the secondcontrol instruction device determines control contents based on theobservation result data transmitted from the observing device andtransmits second control data indicating the determined controlcontents, wherein the relay device relays the first control datatransmitted from the first control instruction device to the movementcontrol device when it is determined that the second control instructiondevice is not provided to the control system, and wherein when it isdetermined that the second control instruction device is provided to thecontrol system, the relay device relays the second control datatransmitted from the second control instruction device instead of thefirst control data to the movement control device, wherein when thesecond control instruction device generates the second control data byusing a function that is not provided to the first control instructiondevice, the second control instruction device includes notification datafor notifying that the second control data is generated by using thefunction, in the second control data, and the relay device compares thefirst control data and the second control data when the notificationdata is not included in the second control data, and determines anabnormality when the first control data and the second control data donot match.
 3. The control system according to claim 2, furthercomprising a third control instruction device that determines controlcontents based on the observation result data, and transmits thirdcontrol data indicating the determined control contents, wherein thethird control instruction device includes a function that is provided tothe second control instruction device, and the relay device compares thesecond control data and the third control data when the notificationdata is included in the second control data, and determines anabnormality when the second control data and the third control data donot match.
 4. The control system according to claim 3, wherein, whendetermining the abnormality in case where the notification data is notincluded in the second control data, the relay device transmits controldata of the first control data, the second control data and the thirdcontrol data whose normality has been determined by a majority vote, tothe movement control device.
 5. A control system that is mounted on amoving object comprising: an observing device that observes surroundingsof the moving object and transmits observation result data indicating anobservation result; a first control instruction device that determinescontrol contents based on the observation result data transmitted fromthe observing device, and transmits first control data indicating thedetermined control contents; a movement control device that controlsmovement of the moving object; and a relay device that determineswhether a second control instruction device is provided to the controlsystem, wherein the second control instruction device determines controlcontents based on the observation result data transmitted from theobserving device and transmits second control data indicating thedetermined control contents, wherein the relay device relays the firstcontrol data transmitted from the first control instruction device tothe movement control device when it is determined that the secondcontrol instruction device is not provided to the control system, andwherein when it is determined that the second control instruction deviceis provided to the control system, the relay device relays the secondcontrol data transmitted from the second control instruction deviceinstead of the first control data to the movement control device,wherein the first control instruction device and the second controlinstruction device diagnose whether or not there are abnormalities inthe first control instruction device and the second control instructiondevice, and transmits abnormality notification data for notifying theabnormalities, to the relay device when detecting the abnormalities, andthe relay device transmits the first control data to the movementcontrol device when receiving the abnormality notification data from thesecond control instruction device even in case where the second controlinstruction device is provided to the control system.
 6. A controlsystem that is mounted on a moving object comprising: an observingdevice that observes surroundings of the moving object and transmitsobservation result data indicating an observation result; a firstcontrol instruction device that determines control contents based on theobservation result data transmitted from the observing device, andtransmits first control data indicating the determined control contents;a movement control device that controls movement of the moving object;and a relay device that determines whether a second control instructiondevice is provided to the control system, wherein the second controlinstruction device determines control contents based on the observationresult data transmitted from the observing device and transmits secondcontrol data indicating the determined control contents, wherein therelay device relays the first control data transmitted from the firstcontrol instruction device to the movement control device when it isdetermined that the second control instruction device is not provided tothe control system, and wherein when it is determined that the secondcontrol instruction device is provided to the control system, the relaydevice relays the second control data transmitted from the secondcontrol instruction device instead of the first control data to themovement control device, wherein the first control data and the secondcontrol data are data frames that comply with a Controller Area Network(CAN) protocol, and the relay device changes a frame ID of the dataframe of the second control data from the frame ID of the second controldata to a frame ID of the first control data.
 7. The control systemaccording to claim 6, wherein the relay device calculates a CyclicRedundancy Check (CRC) value based on the data frame of the changedframe ID, and sets the calculated CRC value to the data frame of thechanged frame ID.
 8. The control system according to claim 1, whereinthe moving object is a car, and the first control instruction device andthe second control instruction device determine the control contents tohedge an obstacle in the surroundings of the car.
 9. A relay device thatrelays data to be transmitted and received in a moving object, the relaydevice comprising: a first relaying unit that receives observationresult data indicating an observation result of surroundings of themoving object, from an observing device and relays the observationresult data to a first control instruction device that determinescontrol contents of the moving object based on the observation resultdata; and a second relaying unit that determines whether a secondcontrol instruction device is provided to the moving object, wherein thesecond control instruction device determines control contents of themoving object based on the observation result data and transmits secondcontrol data indicating the determined control contents, wherein thesecond relaying unit receives first control data indicating the controlcontents of the moving object, from the first control instructiondevice, and relays the first control data to a movement control devicethat controls the moving object when it is determined that the secondcontrol instruction device is not provided to the moving object, andwherein when it is determined that the second control instruction deviceis provided to the moving object, the second relaying unit relays thesecond control data transmitted from the second control instructiondevice instead of the first control data to the movement control device,and wherein when it is determined that the second control instructiondevice is provided to the moving object, the first relaying unittransmits the observation result data received from the observing deviceto both the first control instruction device and the second controlinstruction device, and the second relaying unit receives the firstcontrol data from the first control instruction device and the secondcontrol data from the second control instruction device, respectively,discards the received first control data and transmits the receivedsecond control data to the movement control device.
 10. A control methodthat is performed in a moving object, the control method comprising:observing, by an observing device, surroundings of the moving object,and transmitting, by the observing device, observation result dataindicating an observation result; determining, by a first controlinstruction device, control contents of the moving object based on theobservation result data, and transmitting, by the first controlinstruction device, first control data indicating the determined controlcontents; determining, by a relay device, whether a second controlinstruction device is provided to the moving object, wherein the secondcontrol instruction device determines control contents based on theobservation result data and transmits second control data indicating thedetermined control contents; relaying, by the relay device, the firstcontrol data transmitted from the first control instruction device to amovement control device when it is determined that the second controlinstruction device is not provided to the moving object; relaying, bythe relay device, the second control data transmitted from the secondcontrol instruction device instead of the first control data to themovement control device when it is determined that the second controlinstruction device is provided to the moving object; and controlling, bythe movement control device, movement of the moving object based on thefirst control data or the second control data, wherein the relaying thesecond control data comprises transmitting the observation result datareceived from the observing device to both the first control instructiondevice and the second control instruction device, receiving the firstcontrol data from the first control instruction device and the secondcontrol data from the second control instruction device, respectively,discarding the received first control data and transmitting the receivedsecond control data to the movement control device when it is determinedthat the second control instruction device is provided to the movingobject.